Updated 22 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

281 results · page 4 of 6

Feb 2, 2022A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6CVE-2021-24043 · Other software · Whatsapp · reported by cve-assign@fb.comCritical 9.1
A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call.
Product
Whatsapp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Jan 4, 2022The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp BusCVE-2021-24042 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.
Product
WhatsApp Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Dec 15, 2021In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whether an app is instaCVE-2021-1013 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-186404356
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 7, 2021A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-ofCVE-2021-24041 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-of-bounds write if a user sent a malicious image.
Product
WhatsApp Business for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Oct 7, 2021Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar.CVE-2021-42095 · Other software · Netsarang · reported by MITREHigh 7.5
Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar.
Product
Xshell
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record netsarang.com netsarang.com
Sep 10, 2021On Page SEO + Whatsapp Chat Button Plugin: Reflected Cross-Site ScriptingCVE-2021-38332 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
Product
On Page SEO + Whatsapp Chat Button Plugin
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update On Page SEO + Whatsapp Chat Button Plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 25, 2021The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory aCVE-2018-10790 · Other software · Axiosys · reported by MITREHigh 7.5
The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory allocation failure, as demonstrated by mp2aac.
Product
Bento4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.google.com github.com
Aug 17, 2021A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9.CVE-2020-23333 · Other software · Axiosys · reported by MITREHigh 7.5
A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. This can lead to a denial of service (DOS).
Product
Bento4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 15, 2021NetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations.CVE-2021-37326 · Other software · Netsarang · reported by MITREMedium 5.3
NetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations.
Product
Xshell
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record netsarang.com netsarang.com
Aug 6, 2021index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-38152 · Other software · Chikitsa · reported by MITREMedium 5.4
index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.
Product
Patient Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com chikitsa.net
Aug 6, 2021index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-38151 · Other software · Chikitsa · reported by MITREMedium 5.4
index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.
Product
Patient Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chikitsa.net github.com
Aug 6, 2021index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-38149 · Other software · Chikitsa · reported by MITREMedium 5.4
index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.
Product
Patient Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chikitsa.net github.com
Jun 11, 2021A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed pCVE-2021-24035 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.1
A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.
Product
WhatsApp Business for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Apr 29, 2021Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsessCVE-2021-28899 · Other software · Live555 · reported by MITREHigh 7.5
Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
Product
Streaming Media
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.live555.com lists.live555.com
Apr 19, 2021Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.CVE-2021-31256 · Other software · Gpac · reported by MITREMedium 5.5
Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Product
Gpac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 6, 2021A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to CVE-2021-24027 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.
Product
WhatsApp Business for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Apr 6, 2021A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2CVE-2021-24026 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.21.32, and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write.
Product
WhatsApp Business for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Mar 10, 2021In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an incorrect bounds check.CVE-2021-0396 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-160610106
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Feb 2, 2021A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read aCVE-2020-1910 · Other software · WhatsApp · reported by cve-assign@fb.comHigh 7.8
A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read and write if a user applied specific image filters to a specially crafted image and sent the resulting image.
Product
WhatsApp Business for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Jan 7, 2021An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CrCVE-2021-3011 · Other software · Ftsafe · reported by MITREMedium 4.2
An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).
Product
K13
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ninjalab.io ninjalab.io
Dec 15, 2020In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missing permission check.CVE-2020-27057 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of gpu statistics with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-161903239
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 3, 2020A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corrCVE-2020-1909 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold.
Product
WhatsApp Business for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Nov 3, 2020Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact withCVE-2020-1908 · Other software · Facebook · reported by cve-assign@fb.comMedium 4.6
Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.
Product
WhatsApp Business for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Oct 6, 2020A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApCVE-2020-1907 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Oct 6, 2020A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when CVE-2020-1906 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.8
A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when processing malformed local videos with E-AC-3 audio streams.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Oct 6, 2020Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have alloCVE-2020-1905 · Other software · Facebook · reported by cve-assign@fb.comLow 3.3
Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious third party app chosen to open the file to guess the URIs for previously opened attachments until the opener app is terminated.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Oct 6, 2020A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriCVE-2020-1904 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.5
A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx, xlsx, and pptx files as attachments to messages.
Product
WhatsApp for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Oct 6, 2020An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resultedCVE-2020-1903 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.5
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts.
Product
WhatsApp for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Oct 6, 2020A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 tCVE-2020-1902 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Oct 6, 2020Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message.CVE-2020-1901 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.3
Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message.
Product
WhatsApp for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Sep 14, 2020The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.CVE-2020-12789 · Other software · Microchip · reported by MITREHigh 7.5
The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.
Product
Atsama5d21c-cu Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.f-secure.com labs.f-secure.com
Sep 14, 2020CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.CVE-2020-12788 · Other software · Microchip · reported by MITREHigh 7.5
CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.
Product
Atsama5d21c-cu Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.f-secure.com labs.f-secure.com
Sep 14, 2020Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.CVE-2020-12787 · Other software · Microchip · reported by MITREHigh 7.5
Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.
Product
Atsama5d21c-cu Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.f-secure.com labs.f-secure.com
Sep 3, 2020A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhCVE-2020-1894 · Other software · Facebook · reported by cve-assign@fb.comHigh 8.8
A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for iPhone prior to v2.20.30 could have allowed arbitrary code execution when playing a specially crafted push to talk message.
Product
WhatsApp Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Sep 3, 2020A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prCVE-2020-1891 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20, and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices.
Product
WhatsApp Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Sep 3, 2020A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a stickerCVE-2020-1890 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Sep 3, 2020A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escalation of privilege ifCVE-2020-1889 · Other software · Facebook · reported by cve-assign@fb.comCritical 10
A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escalation of privilege if combined with a remote code execution vulnerability inside the sandboxed renderer process.
Product
WhatsApp Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Sep 3, 2020A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-bounds write via a sCVE-2020-1886 · Other software · Facebook · reported by cve-assign@fb.comHigh 8.8
A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-bounds write via a specially crafted video stream after receiving and answering a malicious video call.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Sep 3, 2020An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially craftCVE-2019-11928 · Other software · Facebook · reported by cve-assign@fb.comMedium 6.1
An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially crafted live location message.
Product
WhatsApp Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record whatsapp.com whatsapp.com
Mar 19, 2020An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code bCVE-2019-16072 · Other software · Netsas · reported by MITRECritical 9.8
An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability to modify any settings in the system, onlCVE-2019-16071 · Other software · Netsas · reported by MITREHigh 8.8
Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability to modify any settings in the system, only view the components. However, it is possible for a low-privileged user to perform all actions as an administrator by bypassing authorization controls and sending requests to the server in the context of an administrator.
Product
Enigma NMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject maCVE-2019-16069 · Other software · Netsas · reported by MITREMedium 6.1
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through the SNMP protocol.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious CVE-2019-16068 · Other software · Netsas · reported by MITREHigh 8.8
A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious manage_files.cgi request. This can be triggered via XSS or an IFRAME tag included within the site.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages.CVE-2019-16063 · Other software · Netsas · reported by MITREHigh 7.5
NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It is possible for an attacker to expose unencrypted sensitive data.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject maCVE-2019-16070 · Other software · Netsas · reported by MITREMedium 6.1
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through web application form inputs.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application.CVE-2019-16067 · Other software · Netsas · reported by MITREHigh 7.5
NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted over cleartext protocols can allow an attacker to steal username and password combinations by intercepting authentication traffic in transit.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior.CVE-2019-16066 · Other software · Netsas · reported by MITREHigh 8.8
An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior. This allows an attacker to upload malicious files and perform arbitrary code execution on the system.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to exCVE-2019-16065 · Other software · Netsas · reported by MITREHigh 8.8
A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user. This affects the search_pattern value of the manage_hosts_short.cgi script.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored CVE-2019-16064 · Other software · Netsas · reported by MITRECritical 9.6
NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of the web root folder. By exploiting this vulnerability, it is possible for an attacker to list operating-system directory contents on the server, create directories and upload files in permissible locations, and modify filenames and delete files that are accessible by the user running the web server instance.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com
Mar 19, 2020NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database.CVE-2019-16062 · Other software · Netsas · reported by MITREMedium 6.5
NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. It is possible for an attacker to expose unencrypted sensitive data.
Product
Enigma Network Management Solution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mogozobo.com mogozobo.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.